SBI and HDFC Leak Fears: Is Your Card Data Exposed — and What to Do in the Next 72 Hours
SBI and HDFC Leak Fears: Is Your Card Data Exposed — and What to Do in the Next 72 Hours
SBI has confirmed 3,897 customer records found on the dark web, and HDFC Bank’s internal probe found two senior executives leaked confidential business information. Neither disclosure lists card numbers, CVVs, PINs or passwords. The bigger risk now is convincing scam calls.
Two of India’s biggest banks were in the same headlines this week, and the forwards have merged them into one alarming question: has my SBI or HDFC card been leaked? The phone in your hand probably has an SMS from one of these banks right now, and you may be wondering whether to block your card, change your PIN or simply wait.
The short answer is calmer than the headlines, but not complacent. The two incidents are very different. Neither bank has said card numbers, CVVs, PINs, passwords or OTPs were exposed. But SBI’s leak does include exactly the kind of personal details a fraudster uses to sound like your bank on the phone. This guide explains what each bank has disclosed, what that means for your cards, and the specific steps worth taking this week.
Quick Summary
Based on what both banks have disclosed, your card numbers and CVV are not reported to be part of either incident. SBI’s 3,897 exposed records contain names, mobile numbers, dates of birth, email and home addresses, branch and customer IDs and loan-lead data. HDFC Bank’s probe concerns confidential business information shared by two executives, not customer records. The practical risk is targeted phishing: someone calling with your real details and asking for an OTP. Never share one, switch off card features you do not use, and report any fraud within three days to keep RBI’s zero-liability protection.
What We Know
- SBI was alerted on 16 October and disclosed the incident to stock exchanges on 21 October 2026.
- SBI found 3,897 customer records with personal information in a set of about 375,000 records.
- SBI’s listed fields do not include account numbers, balances, card details, passwords, PAN or Aadhaar.
- HDFC Bank’s internal probe found two senior executives shared confidential business information.
- Both banks say investigations are continuing.
What Is Still Unclear
- Where SBI’s data came from: the bank itself, a subsidiary or a third-party vendor.
- Whether SBI will individually notify the customers whose records were exposed.
- Whether the 3,897 records belong to 3,897 separate people.
- Whether HDFC Bank’s probe touched any customer data; reports so far describe business information only.
Two Headlines, Two Very Different Incidents
The first step is to stop treating these as one leak. They involve different kinds of information, different causes and different levels of risk to you as a customer.
SBI: personal data from loan leads
According to SBI’s disclosure, reported by Business Standard and The Hacker News, the bank received alerts on 16 October from its threat intelligence provider, the Defence Cyber Agency and CERT-In. A preliminary review of about 375,000 records found on the dark web identified 3,897 customer records containing personal information. The fields include names, gender, mobile numbers, dates of birth, email and residential addresses, branch and CIF identifiers, lead IDs and loan or lead metadata. SBI said “the source and extent of the exposure were still being investigated,” that it had activated incident response and engaged a CERT-In empanelled agency, and that there was no material impact on its operations.
HDFC Bank: an insider leak of business strategy
Business Today, citing a Bloomberg report, said HDFC Bank’s internal probe found two senior executives disclosed confidential business strategies and potentially market-sensitive information to outsiders. The report does not mention customer, account or card data. The bank acknowledged an internal review and said appropriate action would be taken. This is a governance matter for shareholders and regulators. On what has been reported, it is not a customer data breach.
Field by Field: What a Fraudster Could Do With Each Detail
Risk depends on which fields leaked. A card number with CVV can be used for some online purchases. A phone number and birth date cannot move money on their own, but they make a scam call far more convincing. This table covers every field type in play.
| Data field | In SBI leak? | In HDFC probe? | Risk level | How it is misused |
|---|---|---|---|---|
| Name and gender | Yes | Not reported | Low alone | Personalises scam calls |
| Mobile number | Yes | Not reported | Medium | Targeted calls, SMS and WhatsApp phishing |
| Date of birth | Yes | Not reported | Medium | Answers “security questions” to sound official |
| Email and home address | Yes | Not reported | Medium | Fake emails, courier and KYC scams |
| Branch, CIF, lead and loan data | Yes | Not reported | Medium | Fake loan offers and “pre-approved” scams |
| Card number, expiry, CVV | Not listed | Not reported | High if leaked | Online purchases where OTP is bypassed |
| PIN, password, OTP | Not listed | Not reported | Critical if leaked | Direct account access |
| Account number, balance, PAN, Aadhaar | Not listed | Not reported | High if leaked | Identity fraud and loan fraud |
The pattern is clear. The SBI fields are identity and contact details, the raw material for social engineering. That is why the most important protection is not blocking your card but refusing to be talked into sharing an OTP, PIN or screen access, no matter how much the caller already knows about you.
What people get wrong
Many people treat a caller who knows their full name, date of birth and branch as proof that the call is genuine. After a leak like this, it proves the opposite: those are exactly the details now circulating. A real bank will not ask you for an OTP, PIN, CVV or to install a screen-sharing app. Anyone who does is not your bank, however accurate their information is.
Why Your Card Is Harder to Misuse Than It Was Five Years Ago
Even if card details did leak in some future incident, Indian rules now make misuse harder than in many countries. Three protections do most of the work.
Tokenisation keeps merchants from storing your card
Since RBI’s card-on-file tokenisation rules took effect in October 2022, online merchants cannot store your actual card number. They hold a token that works only with that merchant. A breach at a shopping site therefore exposes tokens, not usable card numbers.
Additional authentication on domestic online payments
Most domestic online card payments require an additional factor, usually an OTP sent to your registered mobile. That is why scammers who have your phone number try so hard to get the OTP from you. The OTP, not the card number, is the real key.
Card controls you can switch off yourself
RBI requires banks to let customers switch online, international and contactless usage on and off and to set limits. New cards are issued with international and online usage disabled until the customer enables them. If you never shop abroad, turning off international transactions closes a common fraud route in seconds.
The 3-Day Rule That Decides Who Pays for a Fraud
If money does go missing, how fast you report it matters as much as what happened. RBI’s 2017 circular on limiting customer liability in unauthorised electronic transactions sets clear thresholds, and every bank’s own policy builds on them.
The same circular puts the burden of proving customer liability on the bank, requires the disputed amount to be credited to your account within 10 working days of reporting, and asks banks to resolve complaints within 90 days. The catch is negligence: if a loss happens because you shared your OTP, PIN or card details, you bear the loss until you report it. That is why the one thing the SBI leak changes is how carefully you must treat calls.
| Situation | Reported in 3 days | Reported in 4 to 7 days | Reported after 7 days |
|---|---|---|---|
| Bank’s fault or system breach | ₹0 | ₹0 | ₹0 |
| Third-party fraud, basic savings account | ₹0 | Up to ₹5,000 | Bank policy |
| Third-party fraud, savings or card with limit up to ₹5 lakh | ₹0 | Up to ₹10,000 | Bank policy |
| Third-party fraud, card with limit above ₹5 lakh | ₹0 | Up to ₹25,000 | Bank policy |
| You shared OTP, PIN or CVV | Full loss until reported | Full loss until reported | Full loss until reported |
Worked example: Meera’s ₹42,000 card fraud
Meera, an SBI customer with a credit card limit of ₹3 lakh, spots two unrecognised online charges of ₹21,000 each on a Saturday. If she reports on Monday, within three working days, her liability is zero and the bank should credit ₹42,000 within 10 working days. If she waits until the following Thursday, her liability can be up to ₹10,000 per transaction under the RBI caps, so up to ₹20,000. If the charges happened because she read an OTP to a caller, she could bear the full ₹42,000. These figures follow RBI’s framework; your bank’s own policy may be more generous, never less.
Four Scam Scripts to Expect in the Coming Weeks
Fraud after a data leak tends to follow patterns, because the leaked fields suggest the story the scammer will tell. With names, birth dates, addresses and loan-lead details in circulation, these are the approaches most worth recognising before they reach you.
The “your data was leaked, let us secure your account” call
This is the most direct exploitation of the headlines. The caller says they are from the bank’s security team, confirms your name and date of birth to sound genuine, and says your account needs to be “re-verified” because of the leak. The request that follows is always for an OTP, a card PIN or the installation of an app. The genuine response from any bank to a leak is to strengthen its own systems; it does not need you to read out codes.
The pre-approved loan offer
SBI’s exposed records include loan-lead information, which means scammers may know that you once enquired about a loan. Expect messages offering a “pre-approved” personal or home loan at an attractive rate, with a small processing fee to be paid first or a link to “complete KYC”. Legitimate lenders deduct fees from the disbursed amount and do not ask you to transfer money upfront to an individual’s account.
The courier, KYC or reward-points message
With home addresses and email IDs exposed, fake courier delivery notices and “KYC expiring” emails become easier to personalise. Reward-points messages claiming your card points expire today are a long-running variant aimed at card holders. All of them push you to a look-alike website that asks for card number, expiry, CVV and then the OTP.
The refund or reversal trap
Some scammers claim a wrong transaction was made to your account and ask you to “approve” a refund through a UPI request. Approving a collect request sends money out of your account, never into it. Receiving money on UPI never requires you to enter your PIN.
The common thread is simple. Each script ends with you doing something: sharing a code, clicking a link, paying a fee or entering a PIN. If a call or message about the leak ends with a request like that, it is the scam.
Your 72-Hour Plan After a Leak Headline
You do not need to cancel every card because of a news story. You do need to tighten the controls fraudsters rely on. These steps take less than half an hour in total and work for customers of any bank.
- Set per-transaction and daily limits on each card at levels close to your real spending, so a single fraud cannot drain the full limit.
- Change internet and mobile banking passwords if you reuse them on other sites, and enable app-level biometrics where available.
- Do not click links in messages about “KYC updates”, “reward points expiring” or “loan pre-approvals” for the next few weeks; open the bank app directly instead.
- If you are an SBI customer who had a loan enquiry or lead, expect fake loan offers and treat them with extra suspicion.
- Save the official customer care numbers from the bank’s website in your phone, so you never have to search for them in a hurry.
If Money Goes Missing: The Escalation Ladder
Speed matters most in the first hours, when money can still be frozen before it moves through mule accounts. National figures show how much this helps.
More than 24 lakh complaints reached the national cybercrime portal in 2025, according to the same figures, and the system saved more than ₹8,189 crore by freezing funds quickly. The difference between a frozen and a lost transaction is often measured in hours, which is why calling 1930 comes before anything else.
How This Compares With Past Indian Bank Incidents
Indian banks have faced several data incidents over the past decade. Some involved actual card details; many did not. Business Standard’s round-up this week puts the SBI incident in context.
Frequently Asked Questions
Was SBI or HDFC credit card data leaked?
Not according to what has been disclosed. SBI’s filing lists names, mobile numbers, birth dates, addresses and loan-lead data, not card numbers, CVVs, PINs or passwords. HDFC Bank’s probe concerns business information shared by two executives, with no customer data reported.
Should I block my SBI or HDFC card after the leak?
Blocking is not necessary on current information. Instead, switch off international, online or contactless use you do not need, set limits and review recent transactions. Block immediately if you see any transaction you do not recognise.
How do I know if my SBI data was leaked?
SBI has not said whether it will notify affected customers individually. Assume your contact details may be known to scammers and treat unexpected calls and messages with extra caution.
What is the RBI rule if money is stolen from my card?
If you report a third-party fraud within three working days, your liability is zero. Between four and seven days, it is capped at ₹5,000, ₹10,000 or ₹25,000 depending on account or card type. If you shared your OTP or PIN, you bear the loss until you report it.
Where do I report a cyber fraud in India?
Call the national helpline 1930 or file at cybercrime.gov.in as soon as possible, and inform your bank in writing. Quick reporting helps freeze money before it moves.
Can someone use my card without the OTP?
Most domestic online card payments require an OTP or similar additional factor. Some international or contactless transactions may not, which is why switching off unused features adds protection.
What details will a genuine bank never ask for?
Your OTP, PIN, CVV, full password or a request to install a screen-sharing or remote-access app. A caller who knows your name and date of birth is not proof of a genuine call.
How long does the bank take to refund a disputed fraud?
Under RBI’s framework, the bank should credit the disputed amount within 10 working days of your report and resolve the complaint within 90 days. If it does not resolve it within 30 days, you can approach the RBI Ombudsman.
The Short Version
Your SBI or HDFC card details are not reported to be part of this week’s incidents. SBI confirmed 3,897 customer records containing names, phone numbers, birth dates, addresses and loan-lead data; HDFC Bank’s probe concerns business information leaked by two executives. The real danger is scam calls that use your genuine details to ask for an OTP or PIN. Turn off card features you do not use, set limits, check statements, and never share an OTP. If money goes missing, call 1930 and report to your bank within three working days to keep zero liability.
